Mobile Tracking Would Be Great, If It Weren’t Illegal. (What, Everything Has To Be Perfect With You?)

Written by Mark Rasch
November 16th, 2011

Attorney Mark D. Rasch is the former head of the U.S. Justice Department’s computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

When we told you recently about the Australian shopping mall that tracked customer movement through mobile phone signals, it presented a very compelling CRM opportunity. It would also almost certainly be illegal in the U.S. (What? Everything has to be perfect with you?)

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case. The federal pen register law makes it a crime to “install or use a pen register or trap and trace device” without such a court order, unless you are a “provider of electronic or wire communication service” and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a “provider of electronic communication services.”

But what exactly is a pen register? Here is where it gets a bit funky. Under U.S. law, a “pen register” is “a device or process which records or decodes dialing, routing, addressing or signaling information.” A “trap and trace device,” for which a court order is also required, means a “device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing and signaling information reasonably likely to identify the source of a wire or electronic communication.”

The key here is the definition of “signaling information,” a provision added after Sept. 11, 2001, in statutory amendments under the USA PATRIOT Act. Several courts have concluded that the term “signaling information” includes things like signal strength data used to determine the location of an individual. It appears that the Australian trial, to the extent that it is recording “signaling” information from a cell phone, would be illegal under U.S. law. It’s also pretty creepy.

If a mall operator wanted to know what consumers do when they enter the mall (“Hey, Mom. I want to go to the eatery, then see Santa and then go to the Apple store!”), that operator could follow them around as they browsed. Operators could also use sophisticated pattern recognition software attached to the ubiquitous digital video cameras to track individuals.

The new “cell phone tracking” technology turns the phone in your pocket, one that you are paying for, into a GPS tracking device for the mall. Your cell phone is really just a radio, constantly transmitting and receiving. Although the company’s Web site does not disclose how it works, it is likely that the device is similar to a cell phone tower itself, transmitting a signal to cell phones within range and receiving back a signal from the cell phone.

Unlike a “real” cell provider, the ping it sends is blank.


3 Comments | Read Mobile Tracking Would Be Great, If It Weren’t Illegal. (What, Everything Has To Be Perfect With You?)

  1. Susan Musleh Says:

    Malls track shoppers…. It’s here…. street level data mining. Why should this information be confined to mega mall owners? I get it… personal privacy is gone…. But if our privacy as human beings is traceable by the UI of our cell phones… (And it is) all of us being tracked should have the information available. Street level data mining is very powerful, profitable and scary. A community consciousness needs to be implemented now. Large conglomerates collecting data on an individual bases and collectively leveraging our very movements for their own agendas… is simply exploitation.

  2. John Says:

    You have chosen an unfortunate example of “the person hanging around outside the Victoria’s Secret dressing room was your 70-year-old neighbor.” That is probably a reason why most people would AGREE that this kind of surveillance is necessary.

    Why not make an argument using an example of someone doing something completely innocuous? Such as: “it is a trivial task to cross reference the cell phone data with the payment data and send a message to Store B that someone who just spent $1000 at Store A just walked in their door.”

  3. mobile tracking Says:

    Mobile tracking isn’t necessarily illegal. You can track your family or vehicles to ensure their safety.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.